Crash [@ nsIFrame::Invalidate] with object, positioning and bidi character

VERIFIED FIXED

Status

()

Core
Layout
--
critical
VERIFIED FIXED
11 years ago
7 years ago

People

(Reporter: Martijn Wargers (zombie), Assigned: smontagu)

Tracking

({crash, regression, testcase})

Trunk
x86
Windows XP
crash, regression, testcase
Points:
---
Bug Flags:
in-testsuite +

Firefox Tracking Flags

(Not tracked)

Details

(crash signature)

Attachments

(3 attachments)

(Reporter)

Description

11 years ago
Created attachment 278853 [details]
testcase

See testcase, when hovering over the text input, I crash with current trunk build.

This seems to have regressed since yesterday:
http://bonsai.mozilla.org/cvsquery.cgi?treeid=default&module=all&branch=HEAD&branchtype=match&dir=&file=&filetype=match&who=&whotype=match&sortby=Date&hours=2&date=explicit&mindate=2007-08-28+04&maxdate=2007-08-29+09&cvsroot=%2Fcvsroot
Regression from bug 384527, somehow?

http://crash-stats.mozilla.com/report/index/ec77cc47-567a-11dc-9fb9-001a4bd43ef6
0  	nsIFrame::Invalidate(nsRect const&, int)  	 mozilla/layout/generic/nsFrame.cpp:3536
1 	nsFrameManager::RemoveFrame(nsIFrame*, nsIAtom*, nsIFrame*) 	mozilla/layout/base/nsFrameManager.cpp:688
2 	DeletingFrameSubtree 	mozilla/layout/base/nsCSSFrameConstructor.cpp:9338
3 	nsCSSFrameConstructor::ContentRemoved(nsIContent*, nsIContent*, int, int) 	mozilla/layout/base/nsCSSFrameConstructor.cpp:9490
4 	nsCSSFrameConstructor::RecreateFramesForContent(nsIContent*) 	mozilla/layout/base/nsCSSFrameConstructor.cpp:11074
5 	nsCSSFrameConstructor::RestyleElement(nsIContent*, nsIFrame*, nsChangeHint) 	mozilla/layout/base/nsCSSFrameConstructor.cpp:9939
6 	nsCSSFrameConstructor::ProcessOneRestyle(nsIContent*, nsReStyleHint, nsChangeHint) 	mozilla/layout/base/nsCSSFrameConstructor.cpp:12962
7 	nsCSSFrameConstructor::ProcessPendingRestyles() 	mozilla/layout/base/nsCSSFrameConstructor.cpp:13015
8 	nsCSSFrameConstructor::RestyleEvent::Run() 	mozilla/layout/base/nsCSSFrameConstructor.cpp:13086
9 	nsThread::ProcessNextEvent(int, int*) 	mozilla/xpcom/threads/nsThread.cpp:490
10 	NS_ProcessNextEvent_P(nsIThread*, int) 	nsThreadUtils.cpp:227
11 	nsBaseAppShell::Run() 	mozilla/widget/src/xpwidgets/nsBaseAppShell.cpp:154
12 	nsAppStartup::Run() 	mozilla/toolkit/components/startup/src/nsAppStartup.cpp:170
13 	XRE_main 	mozilla/toolkit/xre/nsAppRunner.cpp:3069
14 	main 	mozilla/browser/app/nsBrowserApp.cpp:153
15 	WinMain 	mozilla/browser/app/nsBrowserApp.cpp:166
16 	__tmainCRTStartup 	crtexe.c:589
(Assignee)

Comment 1

11 years ago
I can reproduce the crash but with a rather different stack:

#6  0xb5cb91d2 in nsCachedStyleData::GetStyleDisplay (this=0xddddddf9)
    at nsStyleStructList.h:95
#7  0xb5cbc7ae in nsStyleContext::GetStyleDisplay (this=0xdddddddd)
    at nsStyleStructList.h:95
#8  0xb5acfbad in nsIFrame::GetStyleDisplay (this=0x8d5e914)
    at nsStyleStructList.h:95
#9  0xb5ab15e5 in GetChildListNameFor (aChildFrame=0x8d5e914)
    at /home/smontagu/mozwork/debugtree/mozilla/layout/base/nsCSSFrameConstructor.cpp:1719
#10 0xb5ab350e in DeletingFrameSubtree (aFrameManager=0x8e09b7c, aFrame=0x0)
    at /home/smontagu/mozwork/debugtree/mozilla/layout/base/nsCSSFrameConstructor.cpp:9338
#11 0xb5accdab in nsCSSFrameConstructor::ContentRemoved (this=0x8df17c0,
    aContainer=0x8e63c00, aChild=0x8dca1c8, aIndexInContainer=1,
    aInReinsertContent=0)
    at /home/smontagu/mozwork/debugtree/mozilla/layout/base/nsCSSFrameConstructo
r.cpp:9490
#12 0xb5acaa17 in nsCSSFrameConstructor::RecreateFramesForContent (
    this=0x8df17c0, aContent=0x8dca1c8)
    at /home/smontagu/mozwork/debugtree/mozilla/layout/base/nsCSSFrameConstructor.cpp:11074
#13 0xb5acb0a8 in nsCSSFrameConstructor::RestyleElement (this=0x8df17c0,
    aContent=0x8dca1c8, aPrimaryFrame=0x8d13cb8, aMinHint=0)
    at /home/smontagu/mozwork/debugtree/mozilla/layout/base/nsCSSFrameConstructor.cpp:9939
#14 0xb5acb2d3 in nsCSSFrameConstructor::ProcessOneRestyle (this=0x8df17c0,
    aContent=0x8dca1c8, aRestyleHint=eReStyle_Self, aChangeHint=0)
    at /home/smontagu/mozwork/debugtree/mozilla/layout/base/nsCSSFrameConstructor.cpp:12962
#15 0xb5acb4f9 in nsCSSFrameConstructor::ProcessPendingRestyles (
    this=0x8df17c0)
    at /home/smontagu/mozwork/debugtree/mozilla/layout/base/nsCSSFrameConstructor.cpp:13015
#16 0xb5acb65e in nsCSSFrameConstructor::RestyleEvent::Run (this=0x8cf5020)
    at /home/smontagu/mozwork/debugtree/mozilla/layout/base/nsCSSFrameConstructor.cpp:13086
(Assignee)

Comment 2

11 years ago
Reverting the patch from bug 384527 doesn't fix this.
(Assignee)

Comment 3

11 years ago
Sorry, comment 2 is wrong: this is indeed a regression from bug 384527
Assignee: nobody → smontagu
(Assignee)

Comment 4

11 years ago
Created attachment 279427 [details]
Frame dump and some debugging output
(Assignee)

Comment 5

11 years ago
Created attachment 279430 [details] [diff] [review]
Patch

I don't really know why this prevents the crash, but it does, and it seems more correct than the original patch to bug 384527 anyway.
Attachment #279430 - Flags: superreview?(roc)
Attachment #279430 - Flags: review?(roc)
Attachment #279430 - Flags: superreview?(roc)
Attachment #279430 - Flags: superreview+
Attachment #279430 - Flags: review?(roc)
Attachment #279430 - Flags: review+
Attachment #279430 - Flags: approval1.9+
(Assignee)

Comment 6

11 years ago
Checked in
Status: NEW → RESOLVED
Last Resolved: 11 years ago
Resolution: --- → FIXED
(Assignee)

Updated

11 years ago
Flags: in-testsuite?
(Reporter)

Comment 7

11 years ago
Verified fixed, using:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9a8pre) Gecko/2007090504 Minefield/3.0a8pre
Status: RESOLVED → VERIFIED
(Assignee)

Updated

11 years ago
Flags: in-testsuite? → in-testsuite+
Crash Signature: [@ nsIFrame::Invalidate]
You need to log in before you can comment on or make changes to this bug.